RE: [BUG] rtw89: kernel panic in rtw89_core_acquire_sta_ba_entry (list_del corruption)

[Ping-Ke Shih <pkshih@realtek.com>]

Ping-Ke Shih wrote:
> (please use plain text and not top posting)
> 
> secure_email <securelevelone@gmail.com>  wrote:
> > Hardware: Realtek RTL8922AE (rtw89_8922ae)
> > Kernel version: 7.1.6-201.fc44.x86_64
> > Distribution: Fedora Cosmic Atomic 44
> >
> > Description:
> > A kernel panic occurs during Block Ack (BA) session acquisition/
> > teardown in the rtw89 driver.
> > The kernel reports a "list_del corruption" inside
> > rtw89_core_acquire_sta_ba_entry, which points to a potential race
> > condition or missing lock during BA entry management under Wi-Fi load.
> 
> Both rtw89_core_acquire_sta_ba_entry() and rtw89_core_release_sta_ba_entry()
> hold wiphy_lock(), so I think there should be no race condition.
> 
> >
> > Steps to reproduce:
> > 1. Use computer regularly (specifically on wifi as that is how bug is
> > triggered) no matter if downloading some files, surfing the web,
> > gaming or stepping away from PC.
> > 2. Within a few minutes and up to around 40 minutes bug is triggered.
> 
> From this point, it did connection and disconnection frequently. Are they
> intentional or something wrong?
> 
> May 19 23:47:52 kernel: wlp8s0: authenticate with xx:xx:xx:xx:xx:xx
> 
> The connection becomes disconnected about 1~5 minutes. Did you control
> WiFi via GUI?
> 
> May 19 23:53:06 kernel: wlp8s0: associated
> May 19 23:54:06 kernel: wlp8s0: deauthenticating from xx:xx:xx:xx:xx:xx
> 
> Try to disable power save to see if it can become better:
> 
>    sudo iw wlan0 set power_save off
> 
> >
> > System behavior:
> > Wifi toggle in settings stops functioning (stuck on "enabled"),
> > followed by degradation in certain applications, loss of internet
> > connectivity both in terminal and browser, etc., and if I decide to
> > reboot the system it will hang indefinitely unless I do a hard
> > shutdown.
> >
> > Call Trace / Panic Logs can be found in the attachments below.
> >
> > Additional info:
> > I initially reported this on Red Hat Bugzilla (Bug 2497973), but am
> > sending this upstream as requested to help get the panic backtrace in
> > front of rtw89 maintainers.
> >
> >
> 
> Please apply attached debug patch, and collect and share log to me.
> 

We have reproduced this problem and ongoing to spin a patch, so no need
to test the debug patch. 

In short term, you can connect non-MLO AP to avoid the problem. If
you can build driver and want short term workaround, I can share
one to you.

Could you share your real name? So, I can add Reported-by tag in the
patch.

Ping-Ke